Authority authentication system for electronic device and method of operating same

Abstract

An authority authentication system includes an electronic device configured to generate a first unique asymmetric key pair, including a first public key and a first private key, a certificate authority server configured to generate a unique asymmetric key certificate and a unique certificate chain, and inject the unique certificate chain into the electronic device, at least one owner terminal device configured to request authority authentication from the electronic device based on at least one owner certificates and at least one owner key pair corresponding to the at least one owner terminal device, the at least one owner key pair including at least one public owner key and at least one private owner key, a communication network including a secure communication channel configured to transmit and receive the at least one owner certificate and the at least one public owner key.

What is claimed is: 
     
         1 . An authority authentication system comprising:
 an electronic device configured to generate a first unique asymmetric key pair, including a first public key and a first private key;   a certificate authority server configured to generate a unique asymmetric key certificate and a unique certificate chain, and inject the unique certificate chain into the electronic device;   at least one owner terminal device configured to request authority authentication from the electronic device based on at least one owner certificate and at least one owner key pair corresponding to the at least one owner terminal device, the at least one owner key pair including at least one public owner key and at least one private owner key; and   a communication network including a secure communication channel configured to transmit and receive the at least one owner certificate and the at least one public owner key,   wherein the electronic device is further configured to,
 form an authority certificate chain including the unique certificate chain and the at least one owner certificate; and 
 change the authority certificate chain based on authentication of an authority of the owner terminal device. 
   
     
     
         2 . The authority authentication system of  claim 1 , wherein the electronic device includes:
 memory including at least one slot configured to store the authority certificate chain; and   processing circuitry configured to,   generate a unique identifier associated with the electronic device,   generate the first unique asymmetric key pair based on the unique identifier, and   verify the unique certificate chain including the unique asymmetric key certificate based on the first private key.   
     
     
         3 . The authority authentication system of  claim 2 , wherein the memory includes:
 a 0-th slot configured to store an immutable unique certificate chain; and   a first slot configured to store a variable authority certificate chain.   
     
     
         4 . The authority authentication system of  claim 2 , wherein the memory and the processing circuitry are manufactured based on a device identifier composition engine (DICE) standard. 
     
     
         5 . The authority authentication system of  claim 3 , wherein the certificate authority server is further configured to:
 receive the first public key; and   electronically sign the owner certificate for the first public key.   
     
     
         6 . The authority authentication system of  claim 5 , wherein the electronic device is further configured to:
 receive the electronically signed owner certificate and the public owner key;   determine whether the owner terminal device has authority based on the unique asymmetric key certificate;   encrypt a nonce number with the public owner key based on results of the determination; and   transmit the encrypted nonce number to the owner terminal device.   
     
     
         7 . The authority authentication system of  claim 6 , wherein the owner terminal device is further configured to:
 decrypt the encrypted nonce number with the private owner key; and   transmit the decrypted nonce number to the electronic device.   
     
     
         8 . The authority authentication system of  claim 7 , wherein the electronic device is further configured to:
 verify the decrypted nonce number with the nonce number; and   based on results of the verification of the decrypted nonce number, store the owner certificate in the memory and change the authority certificate chain stored in the memory.   
     
     
         9 . The authority authentication system of  claim 5 , wherein the at least one owner terminal device includes:
 a first owner terminal device configured to generate a first owner certificate and a first owner key pair;   a second owner terminal device configured to generate a second owner certificate and a second owner key pair, the second owner key pair including a second private owner key and a second public owner key,   wherein the first owner terminal device is further configured to electronically sign the second owner certificate based on the first owner certificate electronically signed by the certificate authority server; and   wherein the second owner terminal device is further configured to request authority authentication to be performed by the electronic device by transmitting the electronically signed second owner certificate and the second public owner key to the electronic device.   
     
     
         10 . The authority authentication system of  claim 9 , wherein the electronic device is further configured to:
 change the authority certificate chain in response to successfully authorizing the second owner terminal device, the changing the authority certificate chain including,   overwriting a first authority certificate chain including the first owner certificate with a second authority certificate chain including the second owner certificate.   
     
     
         11 . The authority authentication system of  claim 10 , wherein
 the second owner terminal device is further configured to request authority authentication from the electronic device by transmitting slot information in which the first authority certificate chain is stored to the electronic device; and   the electronic device is further configured to verify the slot information, and   replace the first authority certificate chain with the second authority certificate chain based on results of the verification.   
     
     
         12 . The authority authentication system of  claim 11 , wherein the electronic device is further configured to:
 replace the first authority certificate chain with the second authority certificate chain in response to determining that the slot information is correct; and   determine whether the second owner terminal device has authority based on the unique certificate chain stored in the 0-th slot in response to determining that the slot information is incorrect.   
     
     
         13 . The authority authentication system of  claim 1 , wherein the secure communication channel is a secure communication session using a security protocol and data model (SPDM) standard. 
     
     
         14 . An electronic device comprising:
 memory including at least one slot configured to store a unique certificate chain including a unique asymmetric key certificate; and   processing circuitry configured to,   generate a unique identifier associated with the electronic device;   generate a unique asymmetric key pair based on the unique identifier, the unique asymmetric key pair including a first public key and a first private key; and   verify the unique certificate chain based on the first private key.   
     
     
         15 . An authority authentication method comprising:
 generating, using processing circuitry, a unique asymmetric key pair, the unique asymmetric key pair including a first public key and a first private key;   transmitting, using the processing circuitry, the first public key to a certificate authority server;   receiving, using the processing circuitry, a unique certificate chain including a unique asymmetric key certificate generated based on the first public key;   receiving, using the processing circuitry, an authority authentication request from an owner terminal device, the authority authentication request including an owner certificate and a public owner key associated with the owner terminal device;   forming, using the processing circuitry, an authority certificate chain including the owner certificate and the unique certificate chain; and   changing, using the processing circuitry, the authority certificate chain in response to results of the authority authentication request.   
     
     
         16 . The authority authentication method of  claim 15 , wherein
 the owner certificate for the first public key is electronically signed by the certificate authority server;   the authority authentication request includes the electronically signed owner certificate; and   the method further comprises,
 determining whether the electronically signed owner certificate is authorized, based on the unique asymmetric key certificate. 
   
     
     
         17 . The authority authentication method of  claim 16 , wherein the forming of the authority certificate chain includes:
 encrypting a nonce number with the public owner key associated with the owner terminal device based on results of the determination of the authority of the electronically signed owner certificate;   transmitting the encrypted nonce number to the owner terminal device, the transmitting causing the owner terminal device to decrypt the encrypted nonce number with a private owner key associated with the owner terminal device;   receiving the decrypted nonce number from the owner terminal device;   determining whether the decrypted nonce number matches the nonce number;   storing the owner certificate according to results of the determination of whether the decrypted nonce number matches; and   forming the authority certificate chain based on the stored owner certificate.   
     
     
         18 . The authority authentication method of  claim 17 , wherein
 the owner certificate is a first owner certificate associated with a first owner terminal device; and   the first owner terminal device is configured to electronically sign a second owner certificate associated with a second terminal device, based on the electronically signed first owner certificate.   
     
     
         19 . The authority authentication method of  claim 18 , wherein the changing of the authority certificate chain further includes:
 receiving a second authority authentication request from a second owner terminal device, the second authority authentication request including the electronically signed second owner certificate;   determining whether the electrically signed second owner certificate is authorized, based on the first owner certificate;   encrypting a second nonce number using a second public owner key associated with the second owner terminal device in response to the authorized second authority authentication request;   transmitting the encrypted second nonce number to the second owner terminal device, the transmitting causing the second owner terminal device to decrypt the encrypted second nonce number using a second private owner key associated with the second owner terminal device;   receiving the decrypted second nonce number from the second owner terminal device;   determining whether the decrypted second nonce number matches the second nonce number; and   changing the authority certificate chain based on results of the determination of whether the decrypted second nonce number matches.   
     
     
         20 . The authority authentication method of  claim 19 , wherein the changing of the authority certificate chain includes:
 overwriting a first authority certificate chain including the first owner certificate with a second authority certificate chain including the second owner certificate.